medium6.1
CVE-2019-12387
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Impact
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Twisted | Twisted | before 19.2.1 |
| Fedoraproject | Fedora | Version 29 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 18.04, 19.10 |
| Oracle | Zfs Storage Appliance Kit | Version 8.8 |
| Oracle | Solaris | Version 11 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html
- https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2
- https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/
- https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html
- https://usn.ubuntu.com/4308-1/
- https://usn.ubuntu.com/4308-2/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html
- https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2
- https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/
- https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html
- https://usn.ubuntu.com/4308-1/
- https://usn.ubuntu.com/4308-2/
- https://www.oracle.com/security-alerts/cpuapr2020.html